Today, the Court of Justice of the European Union, in its fundamental PNR judgment in the case “Ligue des droits humains v Conseil des ministres (Case C-817/19)” rejected the years-long retention of flight passenger data of all citizens as contrary to fundamental rights. In principle, the data of passengers on non-European flights may not be retained for longer than six months. Passengers on flights within the EU may only be stored if there is an acute risk of a terrorist attack or if special circumstances justify storage. No black box machine-learning algorithms may be used to assign a risk value to travellers.
Pirate Party MEP and digital freedom fighter Dr Patrick Breyer comments on the ruling:
“The EU surveillance fanatics have once again disregarded our fundamental rights. Today’s ruling protects travellers better from general suspicion and false suspicion rates with error rates of up to 99.9%. Constant observation and suspicion does not protect us against attacks, but destroys our free and open society. The fact that non-transparent black-box machine learning risk evaluation systems have been banned is a particular success against dystopian AI technologies in general, such as ‘video lie detectors’.
I am disappointed that a six-month retention of information of all travellers to and from non-EU countries was allowed at all. In practice It may be difficult to record departures and then delete them individually. However, this decision can not be seen as precedent for the continued ban on blanket retention of call details and mobile phone movement data, which is more sensitive data than air travel information.”